Hunt, remediate, then update before it goes back — the sequence set for Ivanti
For the stack-based buffer overflow in Ivanti Connect Secure and related gateways, CISA set out conducting hunt activities, taking remediation actions where applicable, and applying updates before a device returns to service.
Key facts
- CVE IDCVE-2025-0282
- Affected (vendor / product)Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CWECWE-121
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2025-01-15 (U.S. federal civilian agencies, BOD 22-01)
Key points
- CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and ZTA Gateways.
- The flaw can lead to unauthenticated remote code execution.
- The required action covers going out to look for signs of intrusion, acting on what that turns up where there is something to act on, and putting updates on before a device is allowed back into service.
- The update comes last, so a device stays out of service until hunting and remediation are complete.
- Listed 8 January 2025 with a due date of 15 January, a window of seven days; among the 1,579 entries without an article this site holds as of 2026-09-05, only 17 carry seven days.
1The words before returning to service
This instruction carries a condition of timing. The update is to be applied before the device goes back into service. Put the other way round, the device does not return until hunting and remediation are done.
2Three tasks, in order
- 1Conduct hunt activitiesLook actively for signs that a compromise has already occurred
- 2Take remediation actionsWhere applicable, meaning where the hunt found something
- 3Apply updatesOnly after the preceding steps, apply the update
- 4Return to serviceThe device goes back only once the update has been applied
The update comes last, which sets this entry apart from the others. Ordinarily the update is the first thing done. Here hunting comes first and the update becomes the step immediately before return to service.
3Why that order
Hunting after the fact risks losing the traces to the update itself. If evidence of intrusion is overwritten in the course of updating, the means of establishing what happened goes with it. Placing the update last reads as a way of protecting that order.
4Seven days
Seven days to hunt, remediate, update and return to service. Against the work asked for, the time allowed sits on the short side. The next article takes up an entry that did not ask for a fix at all.
Why it matters
Applying the update first is the usual order, but where compromise is likely to have happened already that order can destroy the traces. Placing the hunt first and the update immediately before return to service reads as a design for keeping the means of establishing what happened. When an instruction carries a condition of timing, there is a reason the order has to hold.
FAQ
Why does hunting come before updating?
What does where applicable mean?
When may a device return to service?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).